CRM/Core/IDS.php

   1 <?php
   2 /*
   3  +--------------------------------------------------------------------+
   4  | CiviCRM version 4.6                                                |
   5  +--------------------------------------------------------------------+
   6  | Copyright CiviCRM LLC (c) 2004-2014                                |
   7  +--------------------------------------------------------------------+
   8  | This file is a part of CiviCRM.                                    |
   9  |                                                                    |
  10  | CiviCRM is free software; you can copy, modify, and distribute it  |
  11  | under the terms of the GNU Affero General Public License           |
  12  | Version 3, 19 November 2007 and the CiviCRM Licensing Exception.   |
  13  |                                                                    |
  14  | CiviCRM is distributed in the hope that it will be useful, but     |
  15  | WITHOUT ANY WARRANTY; without even the implied warranty of         |
  16  | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.               |
  17  | See the GNU Affero General Public License for more details.        |
  18  |                                                                    |
  19  | You should have received a copy of the GNU Affero General Public   |
  20  | License and the CiviCRM Licensing Exception along                  |
  21  | with this program; if not, contact CiviCRM LLC                     |
  22  | at info[AT]civicrm[DOT]org. If you have questions about the        |
  23  | GNU Affero General Public License or the licensing of CiviCRM,     |
  24  | see the CiviCRM license FAQ at http://civicrm.org/licensing        |
  25  +--------------------------------------------------------------------+
  26 */
  27
  28 /**
  29  *
  30  * @package CRM
  31  * @copyright CiviCRM LLC (c) 2004-2014
  32  * $Id$
  33  *
  34  */
  35 class CRM_Core_IDS {
  36
  37   /**
  38    * Define the threshold for the ids reactions
  39    */
  40   private $threshold = array(
  41     'log' => 25,
  42     'warn' => 50,
  43     'kick' => 75,
  44   );
  45
  46   /**
  47    * The init object
  48    */
  49   private $init = NULL;
  50
  51   /**
  52    * This function includes the IDS vendor parts and runs the
  53    * detection routines on the request array.
  54    *
  55    * @param object cake controller object
  56    *
  57    * @return boolean
  58    */
  59   public function check(&$args) {
  60     // lets bypass a few civicrm urls from this check
  61     static $skip = array('civicrm/admin/setting/updateConfigBackend', 'civicrm/admin/messageTemplates');
  62     $path = implode('/', $args);
  63     if (in_array($path, $skip)) {
  64       return;
  65     }
  66
  67     #add request url and user agent
  68     $_REQUEST['IDS_request_uri'] = $_SERVER['REQUEST_URI'];
  69     if (isset($_SERVER['HTTP_USER_AGENT'])) {
  70       $_REQUEST['IDS_user_agent'] = $_SERVER['HTTP_USER_AGENT'];
  71     }
  72
  73     $configFile = self::createConfigFile(FALSE);
  74
  75     // init the PHPIDS and pass the REQUEST array
  76     require_once 'IDS/Init.php';
  77     try {
  78       $init = IDS_Init::init($configFile);
  79       $ids = new IDS_Monitor($_REQUEST, $init);
  80     }
  81     catch (Exception $e) {
  82       // might be an old stale copy of Config.IDS.ini
  83       // lets try to rebuild it again and see if it works
  84       $configFile = self::createConfigFile(TRUE);
  85       $init = IDS_Init::init($configFile);
  86       $ids = new IDS_Monitor($_REQUEST, $init);
  87     }
  88
  89     $result = $ids->run();
  90     if (!$result->isEmpty()) {
  91       $this->react($result);
  92     }
  93
  94     return TRUE;
  95   }
  96
  97   /**
  98    * Create the default config file for the IDS system
  99    *
 100    * @param bool $force
 101    *   Should we recreate it irrespective if it exists or not.
 102    *
 103    * @return string
 104    *   the full path to the config file
 105    * @static
 106    */
 107   public static function createConfigFile($force = FALSE) {
 108     $config = CRM_Core_Config::singleton();
 109     $configFile = $config->configAndLogDir . 'Config.IDS.ini';
 110     if (!$force && file_exists($configFile)) {
 111       return $configFile;
 112     }
 113
 114     $tmpDir = empty($config->uploadDir) ? CIVICRM_TEMPLATE_COMPILEDIR : $config->uploadDir;
 115
 116     // also clear the stat cache in case we are upgrading
 117     clearstatcache();
 118
 119     global $civicrm_root;
 120     $contents = "
 121 [General]
 122     filter_type         = xml
 123     filter_path         = {$civicrm_root}/packages/IDS/default_filter.xml
 124     tmp_path            = $tmpDir
 125     HTML_Purifier_Path  = IDS/vendors/htmlpurifier/HTMLPurifier.auto.php
 126     HTML_Purifier_Cache = $tmpDir
 127     scan_keys           = false
 128     exceptions[]        = __utmz
 129     exceptions[]        = __utmc
 130     exceptions[]        = widget_code
 131     exceptions[]        = html_message
 132     exceptions[]        = text_message
 133     exceptions[]        = body_html
 134     exceptions[]        = msg_html
 135     exceptions[]        = msg_text
 136     exceptions[]        = msg_subject
 137     exceptions[]        = description
 138     exceptions[]        = intro
 139     exceptions[]        = thankyou_text
 140     exceptions[]        = intro_text
 141     exceptions[]        = body_text
 142     exceptions[]        = footer_text
 143     exceptions[]        = thankyou_text
 144     exceptions[]        = tf_thankyou_text
 145     exceptions[]        = thankyou_footer
 146     exceptions[]        = thankyou_footer_text
 147     exceptions[]        = new_text
 148     exceptions[]        = renewal_text
 149     exceptions[]        = help_pre
 150     exceptions[]        = help_post
 151     exceptions[]        = confirm_title
 152     exceptions[]        = confirm_text
 153     exceptions[]        = confirm_footer_text
 154     exceptions[]        = confirm_email_text
 155     exceptions[]        = report_header
 156     exceptions[]        = report_footer
 157     exceptions[]        = data
 158     exceptions[]        = instructions
 159     exceptions[]        = suggested_message
 160     exceptions[]        = page_text
 161 ";
 162     if (file_put_contents($configFile, $contents) === FALSE) {
 163       CRM_Core_Error::movedSiteError($configFile);
 164     }
 165
 166
 167     // also create the .htaccess file so we prevent the reading of the log and ini files
 168     // via a browser, CRM-3875
 169     CRM_Utils_File::restrictAccess($config->configAndLogDir);
 170
 171     return $configFile;
 172   }
 173
 174   /**
 175    * This function rects on the values in
 176    * the incoming results array.
 177    *
 178    * Depending on the impact value certain actions are
 179    * performed.
 180    *
 181    * @param IDS_Report $result
 182    *
 183    * @return boolean
 184    */
 185   private function react(IDS_Report $result) {
 186
 187     $impact = $result->getImpact();
 188     if ($impact >= $this->threshold['kick']) {
 189       $this->log($result, 3, $impact);
 190       $this->kick($result);
 191       return TRUE;
 192     }
 193     elseif ($impact >= $this->threshold['warn']) {
 194       $this->log($result, 2, $impact);
 195       $this->warn($result);
 196       return TRUE;
 197     }
 198     elseif ($impact >= $this->threshold['log']) {
 199       $this->log($result, 0, $impact);
 200       return TRUE;
 201     }
 202     else {
 203       return TRUE;
 204     }
 205   }
 206
 207   /**
 208    * This function writes an entry about the intrusion
 209    * to the intrusion database
 210    *
 211    * @param array $result
 212    * @param int $reaction
 213    *
 214    * @return boolean
 215    */
 216   private function log($result, $reaction = 0) {
 217     $ip = (isset($_SERVER['SERVER_ADDR']) &&
 218       $_SERVER['SERVER_ADDR'] != '127.0.0.1'
 219     ) ? $_SERVER['SERVER_ADDR'] : (isset($_SERVER['HTTP_X_FORWARDED_FOR']) ?
 220       $_SERVER['HTTP_X_FORWARDED_FOR'] :
 221       '127.0.0.1'
 222     );
 223
 224     $data = array();
 225     $session = CRM_Core_Session::singleton();
 226     foreach ($result as $event) {
 227       $data[] = array(
 228         'name' => $event->getName(),
 229         'value' => stripslashes($event->getValue()),
 230         'page' => $_SERVER['REQUEST_URI'],
 231         'userid' => $session->get('userID'),
 232         'session' => session_id() ? session_id() : '0',
 233         'ip' => $ip,
 234         'reaction' => $reaction,
 235         'impact' => $result->getImpact(),
 236       );
 237     }
 238
 239     CRM_Core_Error::debug_var('IDS Detector Details', $data);
 240     return TRUE;
 241   }
 242
 243   /**
 244    * //todo
 245    */
 246   private function warn($result) {
 247     return $result;
 248   }
 249
 250   /**
 251    *  //todo
 252    */
 253   private function kick($result) {
 254     $session = CRM_Core_Session::singleton();
 255     $session->reset(2);
 256
 257     $msg = ts('There is a validation error with your HTML input. Your activity is a bit suspicious, hence aborting');
 258
 259     $path = implode('/', $args);
 260     if (in_array(
 261       $path,
 262       array("civicrm/ajax/rest", "civicrm/api/json")
 263     )) {
 264       require_once "api/v3/utils.php";
 265       $error = civicrm_api3_create_error(
 266         $msg,
 267         array(
 268           'IP' => $_SERVER['REMOTE_ADDR'],
 269           'error_code' => 'IDS_KICK',
 270           'level' => 'security',
 271           'referer' => $_SERVER['HTTP_REFERER'],
 272           'reason' => 'XSS suspected',
 273         )
 274       );
 275       CRM_Utils_JSON::output($error);
 276     }
 277     CRM_Core_Error::fatal($msg);
 278   }
 279 }